Req #70329 [NEW]: openssl_seal problems

From: totalfix at gmail dot com Operating system: any PHP version: 5.6.12 Package: OpenSSL related Bug Type: Feature/Change Request Bug description:openssl_seal problems Description: ------------ 1) The function openssl_seal by default uses RC4 cipher, which is considered broken and should not be used. I believe it is not a best practice to leave a weak cipher as a default option as many non-experts (like me) will use it. 2) Even if you want to change ciphers by using the parameter $method, you are limited to ciphers without initialization vectors (so no AES CBC). This is leaves us with ciphers like AES ECB, which is also not recommended. Test script: --------------- openssl_seal($data, $sealed, $ekeys, array($pk1), 'AES-256-CBC'); // this fails, because CBC cannot be used, this is not documented, so the users must use trial and error to figure out which cipher is actually working Expected result: ---------------- Somebody with cyrpto knowledge could read my text and decide if it's worth looking into. I could be wrong, if so, I apologise in advance. -- Edit bug report at https://bugs.php.net/bug.php?id=70329&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70329&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70329&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70329&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70329&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70329&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70329&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70329&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70329&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70329&r=support Expected behavior: https://bugs.php.net/fix.php?id=70329&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70329&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70329&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70329&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70329&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70329&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70329&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70329&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70329&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70329&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70329&r=mysqlcfg